@fluixi/oauth2 1.0.0-alpha.1

package/dist/client-auth.cjs

@@ -0,0 +1,115 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client-auth.ts
+var client_auth_exports = {};
+__export(client_auth_exports, {
+  applyClientAuth: () => applyClientAuth,
+  assertUsable: () => assertUsable,
+  resolveMethod: () => resolveMethod
+});
+module.exports = __toCommonJS(client_auth_exports);
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/client-auth.ts
+var CANONICAL = {
+  basic: "client_secret_basic",
+  body: "client_secret_post",
+  client_secret_basic: "client_secret_basic",
+  client_secret_post: "client_secret_post",
+  private_key_jwt: "private_key_jwt",
+  none: "none"
+};
+function resolveMethod(auth) {
+  if (auth.method) return CANONICAL[auth.method] ?? "client_secret_basic";
+  if (auth.privateKey) return "private_key_jwt";
+  return auth.clientSecret ? "client_secret_basic" : "none";
+}
+function assertUsable(auth, who) {
+  if (!auth.clientId) throw new Error(`[fluixi/oauth2] ${who} needs a clientId.`);
+  const method = resolveMethod(auth);
+  if (method === "private_key_jwt" && !auth.privateKey) {
+    throw new Error(
+      `[fluixi/oauth2] ${who}: private_key_jwt needs \`privateKey\`, the JWK whose public half the provider holds.`
+    );
+  }
+  if ((method === "client_secret_basic" || method === "client_secret_post") && !auth.clientSecret) {
+    throw new Error(
+      `[fluixi/oauth2] ${who}: ${method} needs a \`clientSecret\`. A public client should use \`method: 'none'\`, which PKCE is what protects.`
+    );
+  }
+  return method;
+}
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function signAssertion(auth, endpoint) {
+  const jose = await loadJose();
+  const alg = auth.assertionAlgorithm ?? "RS256";
+  const key = await jose.importJWK(auth.privateKey, alg);
+  const kid = auth.keyId ?? auth.privateKey.kid;
+  return new jose.SignJWT({}).setProtectedHeader(kid ? { alg, kid } : { alg }).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(endpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("1m").sign(key);
+}
+async function applyClientAuth(auth, endpoint, headers, form) {
+  switch (resolveMethod(auth)) {
+    case "client_secret_basic": {
+      const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+      headers.authorization = `Basic ${btoa(pair)}`;
+      break;
+    }
+    case "client_secret_post":
+      form.set("client_id", auth.clientId);
+      form.set("client_secret", auth.clientSecret);
+      break;
+    case "private_key_jwt":
+      form.set("client_id", auth.clientId);
+      form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      form.set("client_assertion", await signAssertion(auth, endpoint));
+      break;
+    case "none":
+      form.set("client_id", auth.clientId);
+      break;
+  }
+}

package/dist/client-auth.d.ts

@@ -0,0 +1,43 @@
+export type ClientAuthMethod = 
+/** `Authorization: Basic`, the secret outside the body. The usual default. */
+'client_secret_basic'
+/** The secret in the form. Some providers accept only this. */
+ | 'client_secret_post'
+/** A short-lived assertion signed with a key the provider knows. No secret travels. */
+ | 'private_key_jwt'
+/** A public client: nothing but the id, which PKCE is what protects. */
+ | 'none';
+/** Shorter spellings, because `basic` and `body` are what an app naturally writes. */
+export type ClientAuthMethodInput = ClientAuthMethod | 'basic' | 'body';
+export interface ClientAuth {
+    clientId: string;
+    /**
+     * Defaults to `client_secret_basic` when a secret is present and `none` when it is not,
+     * which is what each kind of client wants without being told.
+     */
+    method?: ClientAuthMethodInput;
+    clientSecret?: string;
+    /** The signing key for `private_key_jwt`, as a JWK. */
+    privateKey?: Record<string, unknown>;
+    /** Names which key, for a provider holding more than one. Read from the key otherwise. */
+    keyId?: string;
+    /** Default `RS256`. */
+    assertionAlgorithm?: string;
+}
+/** What the method resolves to, given what the caller supplied. */
+export declare function resolveMethod(auth: ClientAuth): ClientAuthMethod;
+/**
+ * Check a configuration before anything tries to use it.
+ *
+ * Separate from applying it so a constructor can refuse early, naming what is missing,
+ * rather than failing on the first request with a provider's word for it.
+ */
+export declare function assertUsable(auth: ClientAuth, who: string): ClientAuthMethod;
+/**
+ * Put the client's credentials on a request to `endpoint`.
+ *
+ * Mutates `headers` and `form` rather than returning a new pair, because every caller
+ * already has both and is about to send them.
+ */
+export declare function applyClientAuth(auth: ClientAuth, endpoint: string, headers: Record<string, string>, form: URLSearchParams): Promise<void>;
+//# sourceMappingURL=client-auth.d.ts.map

package/dist/client-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.d.ts","sourceRoot":"","sources":["../src/client-auth.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,gBAAgB;AAC1B,8EAA8E;AAC5E,qBAAqB;AACvB,+DAA+D;GAC7D,oBAAoB;AACtB,uFAAuF;GACrF,iBAAiB;AACnB,wEAAwE;GACtE,MAAM,CAAC;AAEX,sFAAsF;AACtF,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAC;AAWxE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAIhE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAkB5E;AAsCD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/client-auth.js

@@ -0,0 +1,112 @@
+/**
+ * How a client proves who it is to an endpoint that asks.
+ *
+ * One implementation, used by every call that authenticates: the code exchange, the
+ * refresh, the client credentials grant, introspection and revocation. It was four
+ * implementations before, which is how `tokens: 'server'` ended up unable to use
+ * `private_key_jwt` while two other paths could. Adding a method now happens here and
+ * reaches all of them.
+ *
+ * The method names are the ones OIDC uses in `token_endpoint_auth_methods_supported`, so
+ * a provider's discovery document and an app's configuration say the same words.
+ */
+import { OAuthError } from './types.js';
+const CANONICAL = {
+    basic: 'client_secret_basic',
+    body: 'client_secret_post',
+    client_secret_basic: 'client_secret_basic',
+    client_secret_post: 'client_secret_post',
+    private_key_jwt: 'private_key_jwt',
+    none: 'none',
+};
+/** What the method resolves to, given what the caller supplied. */
+export function resolveMethod(auth) {
+    if (auth.method)
+        return CANONICAL[auth.method] ?? 'client_secret_basic';
+    if (auth.privateKey)
+        return 'private_key_jwt';
+    return auth.clientSecret ? 'client_secret_basic' : 'none';
+}
+/**
+ * Check a configuration before anything tries to use it.
+ *
+ * Separate from applying it so a constructor can refuse early, naming what is missing,
+ * rather than failing on the first request with a provider's word for it.
+ */
+export function assertUsable(auth, who) {
+    if (!auth.clientId)
+        throw new Error(`[fluixi/oauth2] ${who} needs a clientId.`);
+    const method = resolveMethod(auth);
+    if (method === 'private_key_jwt' && !auth.privateKey) {
+        throw new Error(`[fluixi/oauth2] ${who}: private_key_jwt needs \`privateKey\`, the JWK whose public half the provider holds.`);
+    }
+    if ((method === 'client_secret_basic' || method === 'client_secret_post') &&
+        !auth.clientSecret) {
+        throw new Error(`[fluixi/oauth2] ${who}: ${method} needs a \`clientSecret\`. A public client should use \`method: 'none'\`, which PKCE is what protects.`);
+    }
+    return method;
+}
+/** `jose`, loaded only when an assertion actually has to be signed. */
+async function loadJose() {
+    try {
+        return await import('jose');
+    }
+    catch {
+        throw new OAuthError('private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.', 'jose_missing');
+    }
+}
+/**
+ * An assertion, per RFC 7523.
+ *
+ * `aud` is the endpoint being called, so it cannot be presented at a different one.
+ * `jti` is fresh, so it cannot be presented twice at the same one. A minute of life makes
+ * a captured one worth almost nothing.
+ */
+async function signAssertion(auth, endpoint) {
+    const jose = await loadJose();
+    const alg = auth.assertionAlgorithm ?? 'RS256';
+    const key = await jose.importJWK(auth.privateKey, alg);
+    const kid = auth.keyId ?? auth.privateKey.kid;
+    return new jose.SignJWT({})
+        .setProtectedHeader(kid ? { alg, kid } : { alg })
+        .setIssuer(auth.clientId)
+        .setSubject(auth.clientId)
+        .setAudience(endpoint)
+        .setJti(crypto.randomUUID())
+        .setIssuedAt()
+        .setExpirationTime('1m')
+        .sign(key);
+}
+/**
+ * Put the client's credentials on a request to `endpoint`.
+ *
+ * Mutates `headers` and `form` rather than returning a new pair, because every caller
+ * already has both and is about to send them.
+ */
+export async function applyClientAuth(auth, endpoint, headers, form) {
+    switch (resolveMethod(auth)) {
+        case 'client_secret_basic': {
+            // Form-encoded before base64, which is what the spec asks for and what a secret
+            // containing a colon or a space depends on.
+            const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+            headers.authorization = `Basic ${btoa(pair)}`;
+            // Deliberately not also in the form: sending it twice is how a provider that reads
+            // the body first ends up ignoring the header.
+            break;
+        }
+        case 'client_secret_post':
+            form.set('client_id', auth.clientId);
+            form.set('client_secret', auth.clientSecret);
+            break;
+        case 'private_key_jwt':
+            form.set('client_id', auth.clientId);
+            form.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+            form.set('client_assertion', await signAssertion(auth, endpoint));
+            break;
+        case 'none':
+            // A public client names itself and proves nothing, which is the whole reason the
+            // authorization code flow needs PKCE.
+            form.set('client_id', auth.clientId);
+            break;
+    }
+}

package/dist/client-auth.mjs

@@ -0,0 +1,84 @@
+import "./chunk-7P6ASYW6.mjs";
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/client-auth.ts
+var CANONICAL = {
+  basic: "client_secret_basic",
+  body: "client_secret_post",
+  client_secret_basic: "client_secret_basic",
+  client_secret_post: "client_secret_post",
+  private_key_jwt: "private_key_jwt",
+  none: "none"
+};
+function resolveMethod(auth) {
+  if (auth.method) return CANONICAL[auth.method] ?? "client_secret_basic";
+  if (auth.privateKey) return "private_key_jwt";
+  return auth.clientSecret ? "client_secret_basic" : "none";
+}
+function assertUsable(auth, who) {
+  if (!auth.clientId) throw new Error(`[fluixi/oauth2] ${who} needs a clientId.`);
+  const method = resolveMethod(auth);
+  if (method === "private_key_jwt" && !auth.privateKey) {
+    throw new Error(
+      `[fluixi/oauth2] ${who}: private_key_jwt needs \`privateKey\`, the JWK whose public half the provider holds.`
+    );
+  }
+  if ((method === "client_secret_basic" || method === "client_secret_post") && !auth.clientSecret) {
+    throw new Error(
+      `[fluixi/oauth2] ${who}: ${method} needs a \`clientSecret\`. A public client should use \`method: 'none'\`, which PKCE is what protects.`
+    );
+  }
+  return method;
+}
+async function loadJose() {
+  try {
+    return await import("./browser-FDUOEUM2.mjs");
+  } catch {
+    throw new OAuthError(
+      "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function signAssertion(auth, endpoint) {
+  const jose = await loadJose();
+  const alg = auth.assertionAlgorithm ?? "RS256";
+  const key = await jose.importJWK(auth.privateKey, alg);
+  const kid = auth.keyId ?? auth.privateKey.kid;
+  return new jose.SignJWT({}).setProtectedHeader(kid ? { alg, kid } : { alg }).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(endpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("1m").sign(key);
+}
+async function applyClientAuth(auth, endpoint, headers, form) {
+  switch (resolveMethod(auth)) {
+    case "client_secret_basic": {
+      const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+      headers.authorization = `Basic ${btoa(pair)}`;
+      break;
+    }
+    case "client_secret_post":
+      form.set("client_id", auth.clientId);
+      form.set("client_secret", auth.clientSecret);
+      break;
+    case "private_key_jwt":
+      form.set("client_id", auth.clientId);
+      form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      form.set("client_assertion", await signAssertion(auth, endpoint));
+      break;
+    case "none":
+      form.set("client_id", auth.clientId);
+      break;
+  }
+}
+export {
+  applyClientAuth,
+  assertUsable,
+  resolveMethod
+};

package/dist/discovery.cjs

@@ -0,0 +1,86 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/discovery.ts
+var discovery_exports = {};
+__export(discovery_exports, {
+  clearDiscoveryCache: () => clearDiscoveryCache,
+  discover: () => discover
+});
+module.exports = __toCommonJS(discovery_exports);
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      throw new OAuthError(
+        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+function clearDiscoveryCache() {
+  cache.clear();
+}

package/dist/discovery.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Endpoints, from the issuer's own document.
+ *
+ * An OIDC provider publishes `/.well-known/openid-configuration`, so an app configures
+ * one issuer URL rather than five endpoints that have to stay in step with it. Curity,
+ * Keycloak, Auth0 and Okta all serve it.
+ *
+ * The result is cached per issuer for the life of the page. The document changes when
+ * the provider is reconfigured, which is not something to re-check on every login.
+ */
+import type { Endpoints } from './types.js';
+export declare function discover(issuer: string, fetcher?: typeof fetch): Promise<Endpoints>;
+/** For a test that needs a clean slate. */
+export declare function clearDiscoveryCache(): void;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAsB5C,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAkDhG;AAED,2CAA2C;AAC3C,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/discovery.js

@@ -0,0 +1,51 @@
+import { OAuthError } from './types.js';
+const cache = new Map();
+/** `https://host/` and `https://host` both give `https://host/.well-known/...`. */
+function documentUrl(issuer) {
+    return `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+}
+export async function discover(issuer, fetcher = fetch) {
+    const cached = cache.get(issuer);
+    if (cached)
+        return cached;
+    const pending = (async () => {
+        let response;
+        try {
+            response = await fetcher(documentUrl(issuer));
+        }
+        catch (cause) {
+            // In a browser a blocked cross-origin read throws before any status exists, and
+            // `fetch` reports only "Failed to fetch". Not every provider allows a page to read
+            // its discovery document: Keycloak does once an origin is configured, Dex and
+            // Google do not. Naming the cause saves a long hunt for a network fault.
+            throw new OAuthError(`Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`, 'discovery_unreachable');
+        }
+        if (!response.ok) {
+            throw new OAuthError(`Discovery failed for ${issuer}: ${response.status}`, 'discovery_failed');
+        }
+        const doc = (await response.json());
+        if (!doc.authorization_endpoint || !doc.token_endpoint) {
+            throw new OAuthError(`${issuer} published a discovery document with no authorization or token endpoint.`, 'discovery_incomplete');
+        }
+        return {
+            authorization: doc.authorization_endpoint,
+            token: doc.token_endpoint,
+            userinfo: doc.userinfo_endpoint,
+            endSession: doc.end_session_endpoint,
+            jwks: doc.jwks_uri,
+            introspection: doc.introspection_endpoint,
+            revocation: doc.revocation_endpoint,
+            issuer: doc.issuer ?? issuer,
+        };
+    })();
+    // Cached before it resolves, so two logins starting at once make one request. Dropped
+    // on failure, so a provider that was briefly down is retried rather than remembered
+    // as broken.
+    cache.set(issuer, pending);
+    pending.catch(() => cache.delete(issuer));
+    return pending;
+}
+/** For a test that needs a clean slate. */
+export function clearDiscoveryCache() {
+    cache.clear();
+}

package/dist/discovery.mjs

@@ -0,0 +1,63 @@
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      throw new OAuthError(
+        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+function clearDiscoveryCache() {
+  cache.clear();
+}
+export {
+  clearDiscoveryCache,
+  discover
+};

package/dist/dpop-LVPWWADA.mjs

@@ -0,0 +1,80 @@
+/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import {
+  OAuthError
+} from "./chunk-4NSOGPLM.mjs";
+import "./chunk-25WE6UWI.mjs";
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("./browser-ONMHX3Z3.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}
+export {
+  boundKeyOf,
+  createDpopKey,
+  nonceFrom,
+  proofFor,
+  thumbprintOf,
+  wantsNonce
+};